Description
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Published: 2026-10-12
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: LDAP Injection
Action: Apply Patch
AI Analysis

Impact

The flaw allows LDAP injection because certain endpoints do not sanitize user-supplied parameters before embedding them in LDAP queries. An attacker can embed crafted LDAP filter syntax in these parameters, causing the application to execute altered directory searches that may reveal or manipulate sensitive information. The vulnerability is represented by CWE-90, which denotes improper handling of LDAP input.

Affected Systems

The vendor frappe is affected. All Frappe releases older than 14.99.2 and all 15.x releases before 15.86.0 contain the flaw. Any deployment of these versions that exposes the vulnerable endpoints is potentially susceptible to exploitation.

Risk and Exploitability

The CVSS v3.1 score of 6.3 indicates a medium severity flaw. The EPSS metric is not reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploitation likelihood is currently low to moderate. Based on the description, it is inferred that the attack vector is remote via HTTP requests to the exposed endpoints, where an attacker sends specially crafted LDAP filter strings to influence directory queries without authentication if the endpoints are publicly reachable.

Generated by OpenCVE AI on October 13, 2026 at 01:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Frappe 15.86.0 or later to eliminate the LDAP injection flaw.
  • If an immediate upgrade is not possible, restrict or block access to the vulnerable endpoints using a web‑application firewall or reverse‑proxy rules that screen out suspicious LDAP filter parameters.
  • Ensure that any remaining LDAP query endpoints perform strict input validation, escape LDAP special characters, or use parameterized LDAP queries to prevent injection attacks.

Generated by OpenCVE AI on October 13, 2026 at 01:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
Title Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
First Time appeared Frappe
Frappe frappe
Weaknesses CWE-90
CPEs cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe frappe
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T14:05:34.349Z

Reserved: 2026-10-12T21:01:54.128Z

Link: CVE-2025-71431

cve-icon Vulnrichment

Updated: 2026-10-15T14:05:29.042Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:19.127

Modified: 2026-10-19T22:10:00.130

Link: CVE-2025-71431

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:00:04Z

Weaknesses
  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')